NPA MIÐSTÖÐIN – Violation Found (Iceland, 2026)

The DPA received a request from the NPA Centre (NPA), the service manager of services for disabled people with long-term care needs, asking whether the Social Services Department of the City of Reykjavik (the controller) is permitted to request personal data. This included bank statements and receipts from the members of the centre relating to expenses for the services of support workers who provide user-directed personal assistance (NPA). In the request, it was made evident that the NPA Centre receives funds from the local authority and distributes it accordingly to its members and supporting staff. Disabled individuals are the line managers and NPA is the employer of the individual’s support workers receiving their timesheets and correspondingly paid their wages. It was further established that the personal data requested by the controller would provide the local authority with comprehensive insight into the life, lifestyle, interests, events, social participation and daily activities of disabled individuals that are with NPA. Thus, the NPA held that the request for the collection of this data goes beyond the legal authority of the controller, is unreasonable and unnecessary. The controller claimed no personal data processing was being undertaken. However, deemed the collection of such necessary to obtain detailed monitoring of the use of funds as some individuals had accumulated high sums of money. The DPA held that in line with complying with its legal obligations, the controller may be able to process personal data including sensitive data in connection to monitoring the expenditure of funds allocated for NPA. Nonetheless, the DPA found that the current planned collection of personal data by the controller from NPA is not compatible with the GDPR and the national data protection act. The DPA clarified that processing must comply with the principles enshrined in Article 5 GDPR particularly transparency and proportionality. The DPA emphasised that collecting such data from all NPA users spendings, irrespective of individual instances, without exhausting less intrusive alternatives would be incompatible with the principle of proportionality and unnecessary. This was considered in connection with the fact that the collection of this personal data indicates a significant amount of information including sensitive data about the daily life and activities undertaken by individuals concerned. The DPA further clarified that in compliance with the principle of transparency, the Social Services Department must ensure that the users of NPA are sufficiently informed that they may be required to provide this data in certain circumstances.